3 ms·

They seem to have specifically ruled it out later in the statement, as iBrute was targeted at Find my iPhone: > None of the cases we have investigated has resu

They seem to have specifically ruled it out later in the statement, as iBrute was targeted at Find my iPhone: > None of the cases we have investigated has resulted from any breach in any of Apple’s systems including iCloud® or Find my iPhone.

Quarrelsome 12y ago
Understood. My second question then is just asking whether Apple have a reputation for truthiness in this arena. I genuinely don't know, I'm asking.
- sigzero 12y ago
  I think that have a pretty good record on owning up to something. It would hurt them much much more to lie about it at this point.
  - DigitalJack 12y ago
    I'm curious what you base that on... that they own up to problems. I know it's certainly not true with hardware issues. They may eventually fix it, but it's rare that they'll comment on it.
slantyyz 12y ago
>> They seem to have specifically ruled it out later in the statement >> > None of the cases we have investigated has resulted from any breach in any of Apple’s systems including iCloud® or Find my iPhone. Have they ruled it out? When you factor that the statement's intended audience is the entire world, not just cyber security experts, the wording becomes muddy, as it depends on you how you interpret the word "breach". If someone successfully uses a password attack, is it actually a 'breach' of Apple's systems? After all, the systems successfully prevented entry until a valid password was entered, which is exactly what the systems were designed to do.
thefreeman 12y ago
Not necessarily. They could make an argument that the services themselves were not "breached", however the users weak passwords allowed them to be compromised.
mikeash 12y ago
That's certainly what they want you to take away from it, but is it what they actually said? Failing to rate limit login attempts is a fuzzy sort of failure. I would probably call it a "vulnerability", but I wouldn't call it a "breach" to take advantage of it to figure out someone's password. To me, this reads as a carefully crafted non-denial that looks like a denial if you don't really pay close attention.

Quarrelsome 12y ago

Understood. My second question then is just asking whether Apple have a reputation for truthiness in this arena. I genuinely don't know, I'm asking.

sigzero 12y ago
I think that have a pretty good record on owning up to something. It would hurt them much much more to lie about it at this point.
- DigitalJack 12y ago
  I'm curious what you base that on... that they own up to problems. I know it's certainly not true with hardware issues. They may eventually fix it, but it's rare that they'll comment on it.

slantyyz 12y ago

>> They seem to have specifically ruled it out later in the statement >> > None of the cases we have investigated has resulted from any breach in any of Apple’s systems including iCloud® or Find my iPhone. Have they ruled it out? When you factor that the statement's intended audience is the entire world, not just cyber security experts, the wording becomes muddy, as it depends on you how you interpret the word "breach". If someone successfully uses a password attack, is it actually a 'breach' of Apple's systems? After all, the systems successfully prevented entry until a valid password was entered, which is exactly what the systems were designed to do.

thefreeman 12y ago

Not necessarily. They could make an argument that the services themselves were not "breached", however the users weak passwords allowed them to be compromised.

mikeash 12y ago

That's certainly what they want you to take away from it, but is it what they actually said? Failing to rate limit login attempts is a fuzzy sort of failure. I would probably call it a "vulnerability", but I wouldn't call it a "breach" to take advantage of it to figure out someone's password. To me, this reads as a carefully crafted non-denial that looks like a denial if you don't really pay close attention.